Weather review fixes: zone-fetch time budget, prod NWS_USER_AGENT (Refs #237)

- Cap one refresh's NWS zone fetches at 15 s wall clock. They run under the
  feed lock, so a hung zone endpoint could otherwise stall every
  /weather/alerts request for minutes; unfinished zones retry next refresh.
- Prod c2-core.env.j2 never set NWS_USER_AGENT, so the VM would have sent the
  contact-less placeholder. Default it to the site URL (overridable via
  vault_nws_user_agent); warn on the .env.example example.com placeholder too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/ansible/roles/deploy/templates/c2-core.env.j2

@@ -44,3 +44,8 @@ AGENT_SERVICE_KEY={{ vault_agent_service_key | default('') }}
 # frontend call to the API would have failed CORS. If the frontend ever moves
 # to app.{{ domain }}, change this at the same time.
 CORS_ORIGINS=["https://{{ domain }}"]
+
+# NWS weather alerts / METAR wind (server-26#237). api.weather.gov requires a
+# User-Agent naming the app and a contact; default to the site URL so a vault
+# that predates this key still sends an identifiable agent, not the placeholder.
+NWS_USER_AGENT={{ vault_nws_user_agent | default('DRB scanner map (https://' ~ domain ~ ')', true) }}